{"id":"CVE-2022-26500","kind":"vulnerability","aliases":["CVE-2022-26500"],"related":[],"title":"veeam backup \\& replication: Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote…","description":"The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Veeam Distribution Service (TCP 9380 by default) exposes internal API functions. A remote attacker can upload and execute code on the backup server. Veeam rates it Critical, CVSS 9.8, and says no authentication is needed. NVD lists it as path traversal (CWE-22) at 8.8 with low privileges required. It is exploited in the wild and on CISA KEV, and backup servers are common ransomware targets.","severity":"critical","cvss":8.8,"epss":null,"exploited":true,"exploited_at":"2022-12-13T00:00:00+00:00","products":[{"name":"Veeam Backup & Replication","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Veeam Backup & Replication","fixed":["10.0.1.4854 P20220304","11.0.1.1261 P20220302"],"affected":"9.5 U3/U4, 10.x < 10.0.1.4854 P20220304, 11.x < 11.0.1.1261 P20220302","ecosystem":"vendor"},{"name":"veeam backup \\& replication","fixed":["10.0.1.4854"],"affected":">= 10.0.0.4442, < 10.0.1.4854","ecosystem":"vendor"},{"name":"veeam backup \\& replication","fixed":["11.0.1.1261"],"affected":">= 11.0.0.825, < 11.0.1.1261","ecosystem":"vendor"},{"name":"veeam backup \\& replication","fixed":[],"affected":"= 9.5.0.1536","ecosystem":"vendor"},{"name":"veeam backup \\& replication","fixed":[],"affected":"= 9.5.4.2615","ecosystem":"vendor"},{"name":"veeam backup \\& replication","fixed":[],"affected":"= 10.0.1.4854","ecosystem":"vendor"},{"name":"veeam backup \\& replication","fixed":[],"affected":"= 11.0.1.1261","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["backup-server","exploited","infrastructure","ransomware","self-hosted","veeam","windows"],"not_affected_if":["isolated-network","patched-build","unknown"],"how_to_check":"In the Veeam console open Help > About and read the build number. Exposed if it is 9.5 U3/U4, 10/10a below 10.0.1.4854 P20220304, or 11/11a below 11.0.1.1261 P20220302. Also check whether TCP 9380 on the backup server is reachable from untrusted networks. New installs from ISOs dated 20220302 or later are not vulnerable.","fix":"Install the cumulative patch on the Veeam Backup & Replication server: 11a build 11.0.1.1261 P20220302 (KB4245) or 10a build 10.0.1.4854 P20220304 (KB4291). Managed servers running the Distribution Service update automatically. 9.5 and plain 10 or 11 should upgrade to 11a or later. Block TCP 9380 from untrusted networks.","status":"open","published_at":"2022-03-17T21:15:08+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:08:50+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T21:08:50Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor update per Veeam's instructions; the fixed version is unknown from the sources.","reach":"network","impact":"high","summary":"Veeam Backup & Replication has an unauthenticated flaw in its Veeam Distribution Service that exposes internal API functions. A remote attacker can use it to upload and execute malicious code on the backup server.","category":"infrastructure","who_cares":["veeam","backup-server","windows"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs arbitrary code on the backup server remotely without credentials.","analyst_note":"Find affected and fixed Veeam Backup & Replication versions and the patch or KB article from Veeam's advisory for CVE-2022-26500, and a detection method.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000452,"input_tokens":2821,"output_tokens":339,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find affected and fixed Veeam Backup & Replication versions and the patch or KB article from Veeam's advisory for CVE-2022-26500, and a detection method.","search":"'-2022':25A,28A '-22':107B '-26500':26A,29A '10':17A '11':20A '8.8':109B '9.5':13A,15A '9.8':93B '9380':69B 'access':144C 'action':170C 'allow':22A,140C 'api':74B,146C,157C 'appli':171C 'applic':139C 'attack':78B,150C 'authent':97B 'backup':2A,11A,31A,34A,37A,40A,43A,46A,49A,52A,55B,86B,125B,137C 'backup-serv':54B 'cisa':122B,168C 'code':83B,167C 'common':128B 'critic':91B 'cve':24A,27A 'cvss':92B 'cwe':106B 'default':71B 'distribut':66B,133C 'execut':82B,164C 'exploit':57B,116B 'expos':72B 'function':75B,147C 'host':62B 'improp':4A 'infrastructur':58B 'input':153C 'instruct':175C 'intern':73B,145C,156C 'kev':123B 'lead':160C 'limit':5A 'list':101B 'low':111B 'malici':166C 'may':159C 'name':8A 'need':99B 'nvd':100B 'path':7A,104B 'per':173C 'privileg':112B 'ransomwar':59B,129B 'rate':89B 'remot':23A,77B,149C 'replic':3A,12A,138C 'replication':32A,35A,38A,41A,44A,47A,50A,53A 'requir':113B,169C 'say':95B 'self':61B 'self-host':60B 'send':152C 'server':56B,87B,126B 'servic':67B,134C 'target':130B 'tcp':68B 'travers':105B 'u3':14A 'u4':16A 'unauthent':141C 'updat':172C 'upload':80B,162C 'user':142C 'veeam':1A,10A,30A,33A,36A,39A,42A,45A,48A,51A,63B,65B,88B,132C 'vendor':174C 'wild':119B 'window':64B 'x':18A,21A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-03-17T21:15:08+00:00","kev":{"dateAdded":"2022-12-13","dueDate":"2023-01-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-26500","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-26500","severity":null,"published_at":"2022-12-13T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:06+00:00","note":null},{"source":"analyst","external_id":"CVE-2022-26500:42","url":null,"severity":null,"published_at":"2026-10-23T21:10:44+00:00","modified_at":"2026-10-23T21:10:44+00:00","first_seen_at":"2026-10-23T21:10:44+00:00","fetched_at":"2026-10-23T21:10:44+00:00","note":"Veeam KB4288 (primary) gives fixed builds 11a 11.0.1.1261 P20220302 and 10a 10.0.1.4854 P20220304; 9.5 has no patch, so upgrade. Exploitation is per CISA KEV and NHS England. No PoC link was read. NVD describes it as authenticated path traversal at CVSS 8.8, while Veeam rates it 9.8 unauthenticated."},{"source":"nvd","external_id":"CVE-2022-26500","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26500","severity":null,"published_at":"2022-03-17T21:15:08+00:00","modified_at":"2026-06-17T04:35:18+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[{"id":910,"url":"https://www.veeam.com/kb4288","title":"Veeam KB4288: CVE-2022-26500 | CVE-2022-26501","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":913,"url":"https://www.veeam.com/kb4291","title":"KB4291: Veeam B&R 10a Cumulative Patch P20220304","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":914,"url":"https://digital.nhs.uk/cyber-alerts/2022/cc-4055","title":"NHS England Digital: Veeam security updates, exploitation reported","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"discussion","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}